Account policy

Introduction

The Account Policy outlines the principles and requirements for managing user accounts and access to agency’s data throughout the user lifecycle. It is intended to ensure that access is granted appropriately, reviewed regularly, and removed promptly when no longer required, while protecting the confidentiality, integrity, and availability of agency information.

Responsibility matrix

Agencies are responsible for their respective account and data management responsibilities described in this policy.

The following RACI matrix defines ownership for account provisioning, access management, and periodic review responsibilities.

Account review

Scheme owners are responsible for assigning and managing permissions and roles for all backoffice users and integrators within their scheme.

To support this process, ApplySG provides monthly access reports listing all onboarded users. Scheme owners should review these reports regularly to ensure that only authorised users retain access to the scheme.

Please ensure that user access lists are kept accurate and up to date at all times.

TechPass users

ApplySG is integrated with TechPass CAM for automated access management. When a TechPass user is offboarded, the following processes are triggered automatically:

• Automatic role and permission removal. The offboarded user’s roles and permissions in ApplySG are automatically removed, including scheme permissions and backoffice user roles.
• Offboarded status display. Assignees who have been offboarded from TechPass will display an “Offboarded” status on dashboards and in the submission sidebar.

This integration ensures that access is promptly revoked upon offboarding, reducing the need for manual intervention and strengthening security.

Note:
The TechPass CAM integration only covers users who have been offboarded from TechPass. It does not automatically remove access for users who have left a project or team but remain in the organisation with an active TechPass account. These cases will need to be managed manually i.e. scheme owners should review monthly reports and update roles and permissions to ensure that only authorised users retain access to the scheme.

WOG Entra ID users

ApplySG does not support automated access management for WOG Entra ID users. Users logged in via WOG Entra ID will need to be managed manually i.e. scheme owners should review monthly reports and update roles and permissions to ensure that only authorised users retain access to the scheme.

Note:
ApplySG will be implementing CAM for WOG Entra ID soon.

Inactive user offboarding

ApplySG automatically offboards backoffice users who have not logged in for 90 consecutive days. This applies to all environments and all users without exception.

When a user is offboarded due to inactivity, the following actions are taken automatically:

• Role and permission removal: All backoffice user roles and lifecycle permissions are permanently removed.
• Offboarded status display: The user is marked as inactive and an “(Offboarded)” label is displayed on dashboards and in the submission sidebar.
• Submission assignments retained: The user remains assigned to their existing submissions but displays as “(Offboarded)”. No manual reassignment is required unless the submission needs to be transferred to another user.

Each successful login resets the 90-day inactivity window. Users do not need to take any other action to remain active.

Email notifications

• 60-day warning: Users who have been inactive for 60 days will receive a one-time email notification warning of upcoming offboarding.
• 75-day reminder: Users who have been inactive for 75 days will receive a follow-up email reminder of upcoming offboarding.
• Final reminders (days 88, 89, 90): Users will receive daily email reminders during the final 3 days before offboarding.
• Offboarding confirmation: After offboarding, the user will receive an email confirming that their access has been removed.

Re-login after offboarding

Offboarded users can log in again at any time.

Upon successful login:

• The user’s active status is restored and the “(Offboarded)” label is removed.
• Roles and lifecycle permissions are not automatically restored. An administrator or the lifecycle owner must manually re-add the user to the appropriate roles and provide them with necessary permissions.

Note:
Re-login only restores the user’s status. All roles and lifecycle permissions must be re-added manually by a backoffice administrator, as these are permanently removed during offboarding.

TechPass user management and access control for non-WOG users

Key responsibility

Agencies are responsible for managing external user access to the ApplySG backoffice through TechPass. ApplySG supports TechPass as an authentication mechanism that enables agencies to onboard external users — such as vendors, consultants, and non-government agency partners — to access the ApplySG backoffice. This allows agencies to support collaborative submission processing while maintaining appropriate security boundaries.

Agency responsibilities

As the sponsoring agency, you are solely responsible for:

• User provisioning: Identifying external users who require access to the ApplySG backoffice and initiating their TechPass onboarding through your organisation’s identity management processes
• Access control: Assigning the appropriate permissions and roles based on each user’s responsibilities
• User offboarding: Revoking access, such as removing from scheme permissions and roles; as well as TechPass offboarding promptly when users leave the organisation or change roles or teams
• Regular access reviews: Periodically reviewing active user accounts to ensure that inactive or departed users no longer have access to sensitive scheme and submission data

Why this matters

Allowing inactive or departed users to retain backoffice access may result in security and compliance risks, including:

• Unauthorized access to applicant data and submissions
• Potential data breaches or misuse of sensitive information
• Non-compliance with data protection requirements and organisational policies

Additional resources

For TechPass onboarding instructions, refer to the TechPass User Guide